Privacy Policy

Last updated: 19 October 2026

Who the controller is

The controller of your data is Top App, Rynek Główny 28, 31-010 Kraków, Poland, VAT ID PL6762666433 (“we”). For anything concerning your data, write to hello@topapp.pl — we answer within one month.

The short version

• You don’t need an account or an email address. The app creates an anonymous account with a random nickname. Signing in with Apple or Google is optional.
• Your nickname is public — it appears in rankings and as the “last tapper” of an egg.
• No ads, no in-app purchases, no chat. We use no advertising identifiers, don’t track you across apps, and don’t sell data.
• We only know your location at country level. We don’t store IP addresses.
• Erase your account and data in the app: Profile → Delete account.

What we process

Account

On first launch we create an anonymous account: a user identifier and a random nickname (e.g. “Tapper4821”) that you can change in the app.

If you choose to sign in with Apple (iOS) or Google (Android) — solely to keep your progress when you switch phones — we store your Apple or Google account identifier and your email address if it is provided to us (with Apple, this may be a relay address).

Gameplay

• your tap count for each egg;
• your best streak;
• badges earned, and whether you were present when an egg hatched;
• the “last tapper” — the nickname of whoever cracked an egg.

Technical data

• Platform (iOS / Android) and app language.
• Country code — from your device region setting and from approximate IP geolocation performed by Cloudflare, at country level only.
• Push notification tokens — up to 5 per account (if you allow notifications).
• Timestamps of when the account was created and last seen.
• IP address — processed by Cloudflare to deliver the live connection and for rate limiting and anti-cheat. We don’t store IP addresses.

Push notifications

Notifications (e.g. “the egg is about to crack”) are optional — you turn them on through the system permission prompt and can turn them off in your phone’s settings at any time. We send them through Firebase Cloud Messaging (Google).

Crash reports

The app uses Firebase Crashlytics (Google), which sends a technical report when the app crashes (e.g. device model, OS and app version, the error trace). The core Firebase Analytics module is included as a dependency of Crashlytics. We don’t use either for advertising or cross-app tracking.

What is public

Your nickname is visible to other players in rankings (e.g. longest streaks) and as the “last tapper” of any egg you crack. Don’t put your real name or anything else you don’t want shown into your nickname.

Why, and on what legal basis

• Account, gameplay, counters, rankings, badges, Apple / Google sign-in — performance of the contract you enter into by using the app (Art. 6(1)(b) GDPR).
• Push notifications — your consent given in the system prompt (Art. 6(1)(a) GDPR); you can withdraw it in your phone’s settings.
• Country, rate limiting, anti-cheat, crash reports — our legitimate interest in fair play and a working service (Art. 6(1)(f) GDPR).

Who we share it with

We use three processors:

• Amazon Web Services — our server and database (PostgreSQL) sit in Frankfurt, that is inside the European Union.
• Cloudflare (USA, global network) — live tap counting (Cloudflare Workers). It processes your IP address to deliver the connection, determine your country, and for rate limiting and anti-cheat. Transfers outside the EEA rely on Standard Contractual Clauses.
• Google (Firebase) (USA) — push notifications (Firebase Cloud Messaging) and crash reports (Firebase Crashlytics). The transfer to the USA relies on Standard Contractual Clauses.

If you sign in with Apple or Google, the sign-in itself is handled by Apple or Google under their own privacy terms.

We do not sell data, share it with advertisers or data brokers, or use advertising identifiers.

How long we keep it

Account and gameplay data are kept for as long as you have an account. Server backups may retain data for up to 30 days before being overwritten. Aggregate global tap totals are anonymous numbers and remain after an account is deleted.

How to erase your data

In the app: Profile → Delete account, or write to hello@topapp.pl. We immediately remove your account (nickname, identifiers, email, country, push tokens) and all your taps, streaks and badges. Your nickname is removed from any egg you cracked — the egg keeps only the crack time and the total. Details: Delete your account.

Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent. Write to hello@topapp.pl. If you haven’t signed in with Apple or Google we don’t know who you are, so to act on a request we will ask for your nickname.

You may also lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland — or with the authority in your own country of residence.

Children

You must be at least 13 years old to use Tap the Egg. In the European Union, users under 16 may use the app only with the consent of a parent or legal guardian. We do not knowingly collect data from children under 13. If you are a parent and believe your child has given us data, write to us and we will erase it.

Changes

We will announce material changes in the app before they take effect. The date of the last update is at the top of this page.

See also: Tap the Egg Terms of Use.